Certificate Key Types

In addition to RSA keys, Sun Java System Web Server 7.0 introduces support for Elliptic Curve Cryptography (ECC).

ECC is emerging as an attractive public-key cryptosystem for mobile and wireless environments. Compared to traditional cryptosystem like RSA, ECC offers equivalent security with smaller key sizes, which results in faster computations, lower power consumption, as well as memory and bandwidth savings. This is especially useful for mobile devices which are typically limited in terms of their CPU, power and network connectivity. Elliptic Curve Cryptography (ECC) has recently been endorsed by the US government.

It is now possible to select whether you want to generate server key pairs (and request certificates for these key pairs) using RSA or ECC. It is also possible to generate a key pair and request a certificate for each key type - this means a server (more precisely, an HTTP listener can have both an RSA certificate and an ECC certificate. It is also possible to have only one or the other.

When generating RSA keys the only choice to make is the key size. For ECC keys you should choose the curve the keypair will be generated on. A number of curves have been named by various organizations (ANSI X9.62, NIST, SECG) and Sun Java System Web Server 7.0 supports all the ones currently specified.

Most commercial CA are not yet issuing certificates for ECC keys as of early 2006. If you intend to request a certificate from a CA (instead of using a self-signed certificate) be sure to contact your preferred CA first to obtain their latest information regarding ECC usage. Ask if they recommend a particular ECC curve for your use case(s). If you do not have guidance on curve selection from your CA nor from your organizations internal policies, here are some recommendations. Keep in mind that since ECC is an emerging technology it is possible that curve recommendations for particular use cases may have changed from the time this document was written.

Requesting a Certificate

Click Server Certificates tab > Request button. Optionally click Request Certificate link from the Common Tasks page.
Select a Configuration

Select a configuration from the configuration list for which you need to install the certificate. The configuration name is added to the Certificate Signing Request (CSR) text. If you do not see any configuration, check out Creating Server Configuration.
Select Token

Select the token (Cryptographic Device), which contains the keys. If your key is stored in the local key database maintained by Sun Java System Web Server 7.0, choose internal. If your key is stored in a Smart Card or other external device or engine, choose the name of the external token from the drop down list box. Enter the password for the selected token.
Enter Details

Before you begin the request process, make sure you know what information your CA requires. Whether you are requesting a server certificate from a commercial CA or an internal CA, you need to provide the following information:
- Server Name must be the fully qualified hostname used in DNS lookups (for example, www.sun.com). This is the hostname in the URL that a browser uses to connect to your site. If these two names don't match, a client is notified that the certificate name doesn't match the site name, creating doubt about the authenticity of your certificate. Some CAs might have different requirements, so it's important to check with them. You can also add the list of server names separated by comma.
  
  You can also enter wildcard and regular expressions in this field if you are requesting a certificate from an internal CA. Most vendors will not approve a certificate request with a wildcard or regular expression entered for common name.
- Organization is the official, legal name of your company, educational institution, partnership, and so on. Most CAs require that you verify this information with legal documents (such as a copy of a business license).
- Organizational Unit is an optional field that describes an organization within your company. This can also be used to note a less formal company name (without the Inc., Corp., and so on).
- Locality is an optional field that usually describes the city, principality, or country for the organization.
- State or Province is usually required, but can be optional for some CAs. Note that most CAs won't accept abbreviations, but check with them to be sure.
- Country is a two-character abbreviation of your country name (in ISO format). The country code for the United States is US.
All this information is combined as a series of attribute-value pairs called the distinguished name (DN), which uniquely identifies the subject of the certificate.
Choose Options

You are required to provide the key information only if you chose to generate the certificate request based on a new key pair. For key type, you can choose RSA or ECC. If the key type is RSA, the key size can be 1024, 2048 or 4098. If your key type is ECC you will also need to select a curve. Keep in mind that generating a new key pair takes time. The longer the key length the longer the time the wizard takes to generate it.

For ECC option, the key concept is that the key pair is on the selected curve (thus, the server certificate generated for that keypair is specific to that curve). Hence key selection is important. You must pick a curve supported by the clients you wish to be able to communicate with your server.

Caution - Be sure to select a key type that the CA (to which you will later submit the request for signing) can certify.
Generate Request

Choose the type of Certificate (Self signed or CA signed). The generated certificate request will be available in ASCII format in case of CA signed certificate. In case of self signed certificate, it will be installed directly. If the type is self signed, provide values for nickname, validity (Months) and the HTTP Listener name for handling secure requests.
Review

This page provides you with the summary of selected options. Click Finish to complete the request generation.